SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Repository Index
47,133 repositories indexed
1–24 of 76 · Most stars
DNS-Blocklists: For a better internet - keep the internet clean!
- dns
- ads
- blacklist
- blocklist
Self-Hosting Guide. Learn all about locally hosting (on premises & private web servers) and managing software applications by yourself or your organization. Including Cloud, LLMs, WireGuard, Automation, Home Assistant, and Networking.
🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2026
- privacy
- security
- censorship
- cybersecurity
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
Web path scanner
Community curated list of templates for the nuclei engine to find security vulnerabilities.
- nuclei-templates
- nuclei
- bugbounty
- security
Fast subdomains enumeration tool for penetration testers
A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.
- self-hosted
- self-hosting
- pastebin
- security
Common User Passwords Profiler (CUPP)
- wordlist-generator
- wordlist
- dictionary-attack
- password
Your web application for managing personal data.
- dashboard
- dashboards
- manager
- symfony
bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS
Potentially dangerous files
- list
- web
- vulnerability
- files
Minimalistic web app designed for sending private and secure notes.
- end-to-end-encryption
- minimalist
- note
- pastebin
Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with Hashcat and John the Ripper.
- wordlist
- wordlist-generator
- password
- cracking
Hashtopolis - distributed password cracking with Hashcat
- cracking
- distributed
- hashcat
- pentesting
Open source, self-hostable watched list for all your content (movies, tv series, anime, games) with user authentication, modern and clean UI and a very simple setup.
A collection of practical security-focused guides and checklists for smart contract development
Generate smart and powerful wordlists
- wordlist
- password
- hacking-tool
- password-cracking
Wordlist, rules and masks from Kaonashi project (RootedCON 2019)
- wordlist
- password
- password-strength
- password-safety
"Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue- & Red Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.
RockYou2021.txt is a MASSIVE WORDLIST compiled of various other wordlists. RockYou2021.txt DOES NOT CONTAIN USER:PASS logins!
- wordlist
- rockyou
- rockyou2021
- wordlists
Remove duplicates from MASSIVE wordlist, without sorting it (for dictionary-based password cracking)
An Intelligent wordlist generator based on user profiling, permutations, and statistics. (Named after the same tool in Mr.Robot series S01E01)
- elliot
- cupp
- passwords
- hacking-tool